echo "================"
echo "shell used for centos 7 init"
echo "author: tangkai 312281264@qq.com"

linux_os()
{
    cnt=$(cat /etc/centos-release|grep "CentOS"|grep "release 7"|wc -l)
    if [ "$cnt" != "1" ];then
       echo "Only support CentOS 7...  exit"
       exit 1
    fi
}

#关闭selinux
selinux_disable()
{
    # 关闭selinux
    if [ $(getenforce) = "Enabled" ]; then
    setenforce 0
    fi
    # selinux设置为disabled
    sed -i 's/SELINUX=enforcing/SELINUX=disabled/g' /etc/selinux/config
    echo "Selinux disabled success!"
}



#关闭防火墙
#
firewalld_stop()
{
    # 关闭防火墙
#    result=`ps -ef | grep firewall | grep -v grep`
    if [ -n `ps -ef | grep firewall | grep -v grep` ]
        then
            systemctl stop firewalld
   fi
    systemctl disable firewalld
    echo "Firewall disabled success!"
}


#脚本需要使用root用户执行
ckroot=$(id -u)
if [ "$ckroot" -ne 0 ] ;then
    echo "must run as root"
    exit 1
fi

##调用判断是否centos 7
linux_os
selinux_disable
firewalld_stop

#如果任何语句的执行结果不是true则应该退出,set -o errexit和set -e作用相同
set -e

echo "yum安装依赖软件"
yum install -y lrzsz
echo "#修改主机名"
echo "主机名取名规则为 csenap01v （cs:长沙 nx：宁夏 en: 项目名字 ap:应用服务器 01：两位数字编号 p:实体机 v:虚拟机）"
read -p "Input the hostname: " hostname
hostnamectl set-hostname $hostname


echo "####时间设置" 
yum install -y ntpdate
timedatectl set-timezone Asia/Shanghai
timedatectl set-local-rtc 0
/usr/sbin/ntpdate ntp1.aliyun.com
echo '*/30 * * * * /usr/sbin/ntpdate ntp1.aliyun.com' >> /var/spool/cron/root
service crond restart

echo "####优化系统"
echo "* soft nofile 65535" >> /etc/security/limits.conf
echo "* hard nofile 65535" >> /etc/security/limits.conf
echo "* soft nproc 65535"  >> /etc/security/limits.conf
echo "* hard nproc 65535"  >> /etc/security/limits.conf
sysctl -p



echo "操作记录审计"
echo "usermonitor" >/var/log/usermonitor.log
chown nobody:nobody /var/log/usermonitor.log
chmod 002 /var/log/usermonitor.log
chattr +a /var/log/usermonitor.log
cat >>/etc/profile << EOF
export HISTTIMEFORMAT='%F %T '
export HISTORY_FILE=/var/log/usermonitor.log
export PROMPT_COMMAND='{ date "+%y-%m-%d %T -- \$(who am i |awk "{print \\\$1\" \"\\\$2\" \"\\\$5}")  -- \$(id|awk "{print \\\$1}") -- \$(history 1 | { read x cmd; echo "\$cmd"; })"; } >>\$HISTORY_FILE' 
EOF
source  /etc/profile



echo "内核参数优化"
cat >>/etc/sysctl.conf << EOF
kernel.sem=6144 50331648 4096 8192
fs.file-max=6815744
fs.aio-max-nr=3145728
net.ipv6.conf.all.disable_ipv6=1
net.ipv6.conf.default.disable_ipv6=1
net.ipv6.conf.lo.disable_ipv6=1
net.ipv6.conf.all.accept_ra=0
net.ipv6.conf.default.accept_ra=0
net.ipv6.conf.default.accept_redirects=0
net.ipv6.conf.all.accept_redirects=0
net.ipv4.icmp_echo_ignore_broadcasts=1
net.ipv4.icmp_ignore_bogus_error_responses=1
net.ipv4.conf.all.send_redirects=0
net.ipv4.conf.default.send_redirects=0
net.ipv4.conf.all.rp_filter=1
net.ipv4.conf.default.rp_filter=1
net.ipv4.conf.all.accept_source_route=0
net.ipv4.conf.default.accept_source_route=0
net.ipv4.tcp_syncookies=1
net.ipv4.conf.all.accept_redirects=0
net.ipv4.conf.default.accept_redirects=0
net.ipv4.conf.all.secure_redirects=0
net.ipv4.conf.default.secure_redirects=0
net.core.somaxconn=32768
net.core.netdev_max_backlog=32768
net.ipv4.tcp_max_syn_backlog=262144
net.ipv4.tcp_fin_timeout=30
net.ipv4.tcp_keepalive_time=900
net.ipv4.tcp_keepalive_probes=6
net.ipv4.tcp_keepalive_intvl=30
net.ipv4.tcp_window_scaling=1
net.ipv4.ip_local_port_range=9000 65535
net.core.rmem_default=8388608
net.core.rmem_max=16777216
net.core.wmem_default=8388608
net.core.wmem_max=16777216
net.ipv4.tcp_rmem=32768 436600 16777216
net.ipv4.tcp_wmem=8192 436600 16777216
kernel.hung_task_timeout_secs=120
kernel.sysrq=0
kernel.core_uses_pid=1
##########MessageQueues##############
kernel.msgmax=655360
kernel.msgmni=4096
kernel.msgmnb=1024000
##########vmconfig###################
vm.drop_caches=1
vm.max_map_count=655360
vm.vfs_cache_pressure=10000
vm.dirty_writeback_centisecs=500
vm.overcommit_memory=0
vm.swappiness=5
vm.min_free_kbytes=1048576
vm.dirty_ratio=40
vm.dirty_background_ratio=20
EOF

sysctl -p




echo "开始系统安全加固-删除系统无用账号"
set +e
userdel adm
userdel lp
userdel shutdwon
userdel halt
userdel uucp
userdel operator
userdel games
userdel gopher
set -e







